CISA Adds CVE-2026-119977 to KEV After 18,500+ Exploitation Attempts on WordPress Upgrade Paths

The vulnerability stems from web-accessible staging directories created during WordPress core updates that remain predictable for roughly the duration of the upgrade window. Attackers can target setup-config.php installer paths without authentication if they time requests correctly after an administrator initiates an update. Wordfence telemetry recorded over 18,500 targeting requests in the first 21 hours after disclosure, with 12,632 additional blocks in the subsequent 24-hour period. Previdian honeypot sensors logged three exploitation attempts on October 30, 2026 from a UK-geolocated IP, confirming active scanning shortly after public details emerged. This pattern aligns with prior race-condition flaws in update mechanisms where attackers monitor for staged files rather than brute-forcing credentials. Self-hosted WordPress instances, especially those on shared hosting or with frequent core updates, face elevated risk because the window cannot be shortened without disabling automatic updates entirely. Federal Civilian Executive Branch agencies must now remediate by the CISA deadline, yet the majority of affected deployments sit outside government networks. The coverage understates how many sites perform unattended core upgrades, creating recurring exposure windows that defenders cannot easily monitor. Independent telemetry shows continued scanning activity, indicating the flaw will remain attractive for opportunistic campaigns until patching reaches critical mass.